Feds: Nigerian stole state school workers’ W-2s in IRS scheme

Updated 10:53 am, Friday, August 4, 2017

An accused cyber criminal from Nigeria has been arrested on fraud and identity theft charges in a scheme that stole the W-2 forms of Connecticut school employees to steal thousands from the IRS.

Daniel Adekunle Ojo, 33,, a citizen of Nigeria living in Durham, N.C., was arrested Thursday by federal authorities. Following his arrest at in Durham residence, Ojo appeared before a U.S. magistrate judge in Greensboro, N.C., and was ordered detained pending his transfer to Connecticut.

As alleged in the criminal complaint, special agents from the FBI’s cybercrime squad in New Haven and the IRS have been investigating “phishing” emails that were sent to various school districts in Connecticut earlier this year.

In February 2017, an employee of the Glastonbury Public Schools received an email that appeared to be sent by another Glastonbury school system employee. The email contained a request to send W-2 tax information for all employees of the school system.

The recipient of the email responded by sending copies of the W-2 information for approximately 1,600 Glastonbury Public Schools employees. After the W-2 information was emailed, approximately 122 suspicious Forms 1040 were filed electronically with the IRS in the names of victims of the Glastonbury phishing scheme.

The 122 tax returns claimed tax refunds totaling $596,897. Approximately six of the returns were processed, and $36,926 in fraudulently-obtained funds were electronically deposited into various bank accounts.

The complaint alleges that OJO controlled or used an aol.com email account and a gmail.com email account involved in this phishing scheme, and that he participated in the scheme to obtain the Glastonbury school system employees’ personal identifying information and use it for personal gain.

This ongoing investigation also includes phishing incidents that victimized the Groton public schools, and the Bloomington Independent School District in Bloomington, Minn.

In March 2017, a Groton school system employee emailed copies of the W-2 information for approximately 1,300 employees. After the W-2 information was sent, approximately 66 suspicious Forms 1040 were filed electronically with the IRS in the names of victims of the Groton phishing scheme.

The tax returns claimed tax refunds totaling $364,188. The fraudulent tax returns were not processed by the IRS because they were flagged as being part of an identity theft scheme, and no money was released in connection with the returns.

The complaint alleges that Ojo entered the U.S. on a visitor’s visa in May 23, 2016, and failed to depart on his scheduled departure date of June 8, 2016.

“Cybercriminals are becoming increasingly cunning in exploiting technology to steal identifying information from unwitting victims,” U.S. Attorney Deirdre Daly said in a release. “Fortunately, our cyber investigators are skilled at cracking these crimes and catching these fraudsters.

“To help avoid becoming a victim, always remember when you click on a link or send an email, check - and then double check - that the link you’re being asked to open, or the email address you are responding to, is authentic. A single mistake can lead to a lot of misery. I commend the FBI cybercrime squad and IRS for quickly bringing this individual to justice. This investigation is ongoing.”